An incident has been running for six hours and the same person has held Incident Commander since it started. How do you hand off the IC role mid-incident without losing the response, and what does the handoff have to transfer?

## Why hand off at all The temptation in a long incident is that the person who has been commanding for six hours knows the most, so replacing them looks like a downgrade. That is true about facts and false about judgment. Late in a long incident, the IC is carrying accumulated fatigue and — more dangerously — accumulated commitment to the theory they endorsed three hours ago. Command is precisely the seat where you want someone willing to say "park that, we have spent long enough." The person who authorised the current line is the least likely to be that someone. The decision therefore has a cost on both sides, and an interviewer wants to hear you weigh it: - **Holding on** costs judgment quality, and it costs it invisibly. Nobody announces that their decisions got worse. - **Handing off** costs a context reload, and it genuinely risks dropping a thread — the workstream nobody mentioned in the brief, the vendor ticket someone opened, the promise to update the exec channel at the hour. The cost of the handoff is bounded and can be engineered down with a good brief. The cost of a fatigued commander is unbounded. So you hand off — and you hand off *before* you are visibly degraded, not after. ## What must actually transfer A handoff that consists of "you're up, read the channel" is not a handoff. Five things transfer: 1. **Impact and trend.** Who is affected, how badly, and whether the numbers are getting better or worse right now — not what they were an hour ago. 2. **The timeline, compressed.** What was tried, what changed as a result, and critically what has been *ruled out*. Ruled-out ground is the most expensive thing to lose, because the fresh IC's instinct is to re-run exactly those experiments. 3. **Active workstreams and owners.** Every thread currently in flight, the named person on it, and when they are next expected to report. If a workstream has no owner, it is not a workstream — resolve that during the brief. 4. **Next decision points and timeboxes.** "If the replica has not caught up by 14:20, we fail over" — a pre-committed decision the incoming IC inherits rather than re-litigates from scratch. 5. **Outstanding commitments.** Updates promised, escalations in flight, external parties waiting. These are what silently break across a handoff, and their breakage is what stakeholders notice. A useful discipline is that this brief is *written*, in the incident channel, not only spoken. Writing it forces the outgoing IC to discover what they were holding only in their head, and it gives everyone else the same picture at the same moment. ## Making the transfer unambiguous Command transfers in an instant, not gradually. The emergency-services convention is worth copying verbatim: an explicit "you are now Incident Commander" and an explicit acceptance, then an announcement to the room and a pin in the channel. Ambiguous command is worse than either person holding it, because two people making decisions is the same as none — and it shows up as contradictory instructions to the responder who is actually touching production. The outgoing IC then has one more job: leave properly. Staying ten to fifteen minutes as an ordinary responder to answer factual questions is helpful. Staying for two hours is not, because the room keeps routing decisions to the person it is used to, and the new IC never actually gets command. If the former IC is still the one being asked "should we roll back?", the handoff did not happen. ## The rest of the response also rotates Command is the role people remember to hand off, but a six-hour incident exhausts the Ops Lead, the comms role and the debuggers too. The IC's job includes noticing that: rotating the person who has been staring at logs since hour one, standing down responders who are no longer needed rather than keeping a dozen people on a bridge out of politeness, and — if the incident is going to run into the night — deliberately releasing half the responders so there is a rested second shift at all. Keeping everyone awake for twelve hours guarantees that hour thirteen has nobody fit to command. ## What good looks like in an interview Say explicitly that you hand off before degradation rather than after, describe the five things the brief carries, insist on the verbal transfer and the pinned announcement, and mention the outgoing commander's obligation to actually leave. Then name the trade honestly: you are trading a known, bounded context cost for an unknown, unbounded judgment cost, and that is why the answer is almost always to hand off.